encrypt traffic with pre-shared key

client/main.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"encoding/base64"
 	"encoding/binary"
 	"encoding/hex"
 	"log"
@@ -10,13 +11,13 @@ import (
 
 	"baalvpn/shared"
 
-	"github.com/songgao/packets/ethernet"
 	"github.com/songgao/water"
 )
 
 const (
 	SERVER_IP  = "172.20.12.47"
 	IFACE_NAME = "baalvpn"
+	PSK        = "rj5FvWB0n342C6UGrAS0gI3GX5ya+lDmC7/XmgFHF+s="
 )
 
 var (
@@ -24,6 +25,7 @@ var (
 	serverAddr *net.UDPAddr
 	iface      *water.Interface
 	conn       *net.UDPConn
+	pskKey     []byte
 )
 
 func main() {
@@ -31,6 +33,12 @@ func main() {
 		panic("root permissions needed")
 	}
 
+	var err error
+	pskKey, err = base64.StdEncoding.DecodeString(PSK)
+	if err != nil {
+		panic(err)
+	}
+
 	listenAddr, err := net.ResolveUDPAddr("udp", ":38000")
 	if err != nil {
 		panic(err)
@@ -99,8 +107,13 @@ func receivePacket(pkt []byte) {
 		setupInterface()
 		go sendPackets()
 	case shared.RESP_DATA:
-		log.Println("received pkt:", hex.EncodeToString(pkt[4:]))
-		if _, err := iface.Write(pkt[4:]); err != nil {
+		decryptedPkt, err := shared.DecryptSym(pskKey, pkt[4:])
+		if err != nil {
+			panic(err)
+		}
+
+		log.Println("received pkt:", hex.EncodeToString(decryptedPkt))
+		if _, err := iface.Write(decryptedPkt); err != nil {
 			log.Println(err)
 		}
 	default:
@@ -129,17 +142,21 @@ func setupInterface() {
 func sendPackets() {
 	log.Println("Listening for packets...")
 
-	var frame ethernet.Frame
 	for {
-		frame.Resize(1500)
-		n, err := iface.Read([]byte(frame))
+		pkt := make([]byte, 1500)
+		n, err := iface.Read([]byte(pkt))
 		if err != nil {
 			panic(err)
 		}
-		frame = frame[:n]
+		pkt = pkt[:n]
 
-		pkt := shared.BuildPkt(shared.REQ_DATA, frame)
-		if _, err := conn.WriteToUDP(pkt, serverAddr); err != nil {
+		encryptedPkt, err := shared.EncryptSym(pskKey, pkt)
+		if err != nil {
+			panic(err)
+		}
+
+		req := shared.BuildPkt(shared.REQ_DATA, encryptedPkt)
+		if _, err := conn.WriteToUDP(req, serverAddr); err != nil {
 			log.Println(err)
 		}
 	}